CVE-2024-32462
Fixed in a distro release EPSS <1%CVSS 8.4
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the `--command` argument of `flatpak run` expects to be given a command to run in the specified Flatpak app, optionally along with some arguments. However it is possible to instead pass `bwrap` arguments to `--command=`, such as `--bind`. It's possible to pass an arbitrary `commandline` to the portal interface `org.freedesktop.portal.Background.RequestBackground` from within a Flatpak app. When this is converted into a `--command` and arguments, it achieves the same effect of passing arguments directly to `bwrap`, and thus can be used for a sandbox escape. The solution is to pass the `--` argument to `bwrap`, which makes it stop processing options. This has been supported since bubblewrap 0.3.0. All supported versions of Flatpak require at least that version of bubblewrap. xdg-desktop-portal version 1.18.4 will mitigate this vulnerability by only allowing Flatpak apps to create .desktop files for commands that do not start with --. The vulnerability is patched in 1.15.8, 1.10.9, 1.12.9, and 1.14.6.
Products: flatpak
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | flatpak | 1.12.9-1.el8_10 |
| AlmaLinux 8 | flatpak-devel | 1.12.9-1.el8_10 |
| AlmaLinux 8 | flatpak-libs | 1.12.9-1.el8_10 |
| AlmaLinux 8 | flatpak-selinux | 1.12.9-1.el8_10 |
| AlmaLinux 8 | flatpak-session-helper | 1.12.9-1.el8_10 |
| AlmaLinux 9 | flatpak | 1.12.9-1.el9_4 |
| AlmaLinux 9 | flatpak-devel | 1.12.9-1.el9_4 |
| AlmaLinux 9 | flatpak-libs | 1.12.9-1.el9_4 |
| AlmaLinux 9 | flatpak-selinux | 1.12.9-1.el9_4 |
| AlmaLinux 9 | flatpak-session-helper | 1.12.9-1.el9_4 |
| Amazon Linux 2 | flatpak | 1.0.9-10.amzn2.0.5 |
| Amazon Linux 2 | flatpak-builder | 1.0.0-10.amzn2.0.5 |
| Amazon Linux 2 | flatpak-devel | 1.0.9-10.amzn2.0.5 |
| Amazon Linux 2 | flatpak-libs | 1.0.9-10.amzn2.0.5 |
| Amazon Linux 2023 | flatpak | 1.15.4-3.amzn2023.0.2 |
| Amazon Linux 2023 | flatpak-devel | 1.15.4-3.amzn2023.0.2 |
| Amazon Linux 2023 | flatpak-libs | 1.15.4-3.amzn2023.0.2 |
| Amazon Linux 2023 | flatpak-selinux | 1.15.4-3.amzn2023.0.2 |
| Amazon Linux 2023 | flatpak-session-helper | 1.15.4-3.amzn2023.0.2 |
| Amazon Linux 2023 | flatpak-tests | 1.15.4-3.amzn2023.0.2 |
| Debian 11 | flatpak | 1.10.8-0+deb11u2 |
| Debian 12 | flatpak | 1.14.4-1+deb12u1 |
| Debian 13 | flatpak | 1.14.6-1 |
| Debian 14 | flatpak | 1.14.6-1 |
| Red Hat Enterprise Linux 7 | flatpak | 0:1.0.9-13.el7_9 |
| Red Hat Enterprise Linux 7 | flatpak-builder | 0:1.0.0-13.el7_9 |
| Red Hat Enterprise Linux 7 | flatpak-debuginfo | 0:1.0.9-13.el7_9 |
| Red Hat Enterprise Linux 7 | flatpak-devel | 0:1.0.9-13.el7_9 |
| Red Hat Enterprise Linux 7 | flatpak-libs | 0:1.0.9-13.el7_9 |
| Red Hat Enterprise Linux 8 | flatpak | 0:1.12.9-1.el8_10 |
| Red Hat Enterprise Linux 8 | flatpak-debuginfo | 0:1.12.9-1.el8_10 |
| Red Hat Enterprise Linux 8 | flatpak-debugsource | 0:1.12.9-1.el8_10 |
| Red Hat Enterprise Linux 8 | flatpak-devel | 0:1.12.9-1.el8_10 |
| Red Hat Enterprise Linux 8 | flatpak-libs | 0:1.12.9-1.el8_10 |
| Red Hat Enterprise Linux 8 | flatpak-libs-debuginfo | 0:1.12.9-1.el8_10 |
| Red Hat Enterprise Linux 8 | flatpak-selinux | 0:1.12.9-1.el8_10 |
| Red Hat Enterprise Linux 8 | flatpak-session-helper | 0:1.12.9-1.el8_10 |
| Red Hat Enterprise Linux 8 | flatpak-session-helper-debuginfo | 0:1.12.9-1.el8_10 |
| Red Hat Enterprise Linux 8 | flatpak-tests-debuginfo | 0:1.12.9-1.el8_10 |
| Red Hat Enterprise Linux 9 | flatpak | 0:1.12.9-1.el9_4 |
| Red Hat Enterprise Linux 9 | flatpak-debuginfo | 0:1.12.9-1.el9_4 |
| Red Hat Enterprise Linux 9 | flatpak-debugsource | 0:1.12.9-1.el9_4 |
| Red Hat Enterprise Linux 9 | flatpak-devel | 0:1.12.9-1.el9_4 |
| Red Hat Enterprise Linux 9 | flatpak-libs | 0:1.12.9-1.el9_4 |
| Red Hat Enterprise Linux 9 | flatpak-libs-debuginfo | 0:1.12.9-1.el9_4 |
| Red Hat Enterprise Linux 9 | flatpak-selinux | 0:1.12.9-1.el9_4 |
| Red Hat Enterprise Linux 9 | flatpak-session-helper | 0:1.12.9-1.el9_4 |
| Red Hat Enterprise Linux 9 | flatpak-session-helper-debuginfo | 0:1.12.9-1.el9_4 |
| Red Hat Enterprise Linux 9 | flatpak-tests-debuginfo | 0:1.12.9-1.el9_4 |
| Red Hat rhel aus 8.2 | flatpak | 0:1.6.2-7.el8_2 |
| Red Hat rhel aus 8.2 | flatpak-debuginfo | 0:1.6.2-7.el8_2 |
| Red Hat rhel aus 8.2 | flatpak-debugsource | 0:1.6.2-7.el8_2 |
| Red Hat rhel aus 8.2 | flatpak-libs | 0:1.6.2-7.el8_2 |
| Red Hat rhel aus 8.2 | flatpak-libs-debuginfo | 0:1.6.2-7.el8_2 |
| Red Hat rhel aus 8.2 | flatpak-selinux | 0:1.6.2-7.el8_2 |
| Red Hat rhel aus 8.2 | flatpak-session-helper | 0:1.6.2-7.el8_2 |
| Red Hat rhel aus 8.2 | flatpak-session-helper-debuginfo | 0:1.6.2-7.el8_2 |
| Red Hat rhel aus 8.2 | flatpak-tests-debuginfo | 0:1.6.2-7.el8_2 |
| Red Hat rhel aus 8.4 | flatpak | 0:1.8.5-5.el8_4 |
| Red Hat rhel aus 8.4 | flatpak-debuginfo | 0:1.8.5-5.el8_4 |
| Red Hat rhel aus 8.4 | flatpak-debugsource | 0:1.8.5-5.el8_4 |
| Red Hat rhel aus 8.4 | flatpak-libs | 0:1.8.5-5.el8_4 |
| Red Hat rhel aus 8.4 | flatpak-libs-debuginfo | 0:1.8.5-5.el8_4 |
| Red Hat rhel aus 8.4 | flatpak-selinux | 0:1.8.5-5.el8_4 |
| Red Hat rhel aus 8.4 | flatpak-session-helper | 0:1.8.5-5.el8_4 |
| Red Hat rhel aus 8.4 | flatpak-session-helper-debuginfo | 0:1.8.5-5.el8_4 |
| Red Hat rhel aus 8.4 | flatpak-tests-debuginfo | 0:1.8.5-5.el8_4 |
| Red Hat rhel aus 8.6 | flatpak | 0:1.8.7-2.el8_6 |
| Red Hat rhel aus 8.6 | flatpak-debuginfo | 0:1.8.7-2.el8_6 |
| Red Hat rhel aus 8.6 | flatpak-debugsource | 0:1.8.7-2.el8_6 |
| Red Hat rhel aus 8.6 | flatpak-libs | 0:1.8.7-2.el8_6 |
| Red Hat rhel aus 8.6 | flatpak-libs-debuginfo | 0:1.8.7-2.el8_6 |
| Red Hat rhel aus 8.6 | flatpak-selinux | 0:1.8.7-2.el8_6 |
| Red Hat rhel aus 8.6 | flatpak-session-helper | 0:1.8.7-2.el8_6 |
| Red Hat rhel aus 8.6 | flatpak-session-helper-debuginfo | 0:1.8.7-2.el8_6 |
| Red Hat rhel aus 8.6 | flatpak-tests-debuginfo | 0:1.8.7-2.el8_6 |
| Red Hat rhel e4s 8.4 | flatpak | 0:1.8.5-5.el8_4 |
| Red Hat rhel e4s 8.4 | flatpak-debuginfo | 0:1.8.5-5.el8_4 |
| Red Hat rhel e4s 8.4 | flatpak-debugsource | 0:1.8.5-5.el8_4 |
| Red Hat rhel e4s 8.4 | flatpak-libs | 0:1.8.5-5.el8_4 |
| Red Hat rhel e4s 8.4 | flatpak-libs-debuginfo | 0:1.8.5-5.el8_4 |
| Red Hat rhel e4s 8.4 | flatpak-selinux | 0:1.8.5-5.el8_4 |
| Red Hat rhel e4s 8.4 | flatpak-session-helper | 0:1.8.5-5.el8_4 |
| Red Hat rhel e4s 8.4 | flatpak-session-helper-debuginfo | 0:1.8.5-5.el8_4 |
| Red Hat rhel e4s 8.4 | flatpak-tests-debuginfo | 0:1.8.5-5.el8_4 |
| Red Hat rhel e4s 8.6 | flatpak | 0:1.8.7-2.el8_6 |
| Red Hat rhel e4s 8.6 | flatpak-debuginfo | 0:1.8.7-2.el8_6 |
| Red Hat rhel e4s 8.6 | flatpak-debugsource | 0:1.8.7-2.el8_6 |
| Red Hat rhel e4s 8.6 | flatpak-libs | 0:1.8.7-2.el8_6 |
| Red Hat rhel e4s 8.6 | flatpak-libs-debuginfo | 0:1.8.7-2.el8_6 |
| Red Hat rhel e4s 8.6 | flatpak-selinux | 0:1.8.7-2.el8_6 |
| Red Hat rhel e4s 8.6 | flatpak-session-helper | 0:1.8.7-2.el8_6 |
| Red Hat rhel e4s 8.6 | flatpak-session-helper-debuginfo | 0:1.8.7-2.el8_6 |
| Red Hat rhel e4s 8.6 | flatpak-tests-debuginfo | 0:1.8.7-2.el8_6 |
| Red Hat rhel e4s 9.0 | flatpak | 0:1.12.5-3.el9_0 |
| Red Hat rhel e4s 9.0 | flatpak-debuginfo | 0:1.12.5-3.el9_0 |
| Red Hat rhel e4s 9.0 | flatpak-debugsource | 0:1.12.5-3.el9_0 |
| Red Hat rhel e4s 9.0 | flatpak-libs | 0:1.12.5-3.el9_0 |
| Red Hat rhel e4s 9.0 | flatpak-libs-debuginfo | 0:1.12.5-3.el9_0 |
| Red Hat rhel e4s 9.0 | flatpak-selinux | 0:1.12.5-3.el9_0 |
| Red Hat rhel e4s 9.0 | flatpak-session-helper | 0:1.12.5-3.el9_0 |
| Red Hat rhel e4s 9.0 | flatpak-session-helper-debuginfo | 0:1.12.5-3.el9_0 |
| Red Hat rhel e4s 9.0 | flatpak-tests-debuginfo | 0:1.12.5-3.el9_0 |
| Red Hat rhel eus 8.8 | flatpak | 0:1.10.7-2.el8_8 |
| Red Hat rhel eus 8.8 | flatpak-debuginfo | 0:1.10.7-2.el8_8 |
| Red Hat rhel eus 8.8 | flatpak-debugsource | 0:1.10.7-2.el8_8 |
| Red Hat rhel eus 8.8 | flatpak-devel | 0:1.10.7-2.el8_8 |
| Red Hat rhel eus 8.8 | flatpak-libs | 0:1.10.7-2.el8_8 |
| Red Hat rhel eus 8.8 | flatpak-libs-debuginfo | 0:1.10.7-2.el8_8 |
| Red Hat rhel eus 8.8 | flatpak-selinux | 0:1.10.7-2.el8_8 |
| Red Hat rhel eus 8.8 | flatpak-session-helper | 0:1.10.7-2.el8_8 |
| Red Hat rhel eus 8.8 | flatpak-session-helper-debuginfo | 0:1.10.7-2.el8_8 |
| Red Hat rhel eus 8.8 | flatpak-tests-debuginfo | 0:1.10.7-2.el8_8 |
| Red Hat rhel eus 9.2 | flatpak | 0:1.12.7-3.el9_2 |
| Red Hat rhel eus 9.2 | flatpak-debuginfo | 0:1.12.7-3.el9_2 |
| Red Hat rhel eus 9.2 | flatpak-debugsource | 0:1.12.7-3.el9_2 |
| Red Hat rhel eus 9.2 | flatpak-devel | 0:1.12.7-3.el9_2 |
| Red Hat rhel eus 9.2 | flatpak-libs | 0:1.12.7-3.el9_2 |
| Red Hat rhel eus 9.2 | flatpak-libs-debuginfo | 0:1.12.7-3.el9_2 |
| Red Hat rhel eus 9.2 | flatpak-selinux | 0:1.12.7-3.el9_2 |
| Red Hat rhel eus 9.2 | flatpak-session-helper | 0:1.12.7-3.el9_2 |
| Red Hat rhel eus 9.2 | flatpak-session-helper-debuginfo | 0:1.12.7-3.el9_2 |
| Red Hat rhel eus 9.2 | flatpak-tests-debuginfo | 0:1.12.7-3.el9_2 |
| Red Hat rhel tus 8.4 | flatpak | 0:1.8.5-5.el8_4 |
| Red Hat rhel tus 8.4 | flatpak-debuginfo | 0:1.8.5-5.el8_4 |
| Red Hat rhel tus 8.4 | flatpak-debugsource | 0:1.8.5-5.el8_4 |
| Red Hat rhel tus 8.4 | flatpak-libs | 0:1.8.5-5.el8_4 |
| Red Hat rhel tus 8.4 | flatpak-libs-debuginfo | 0:1.8.5-5.el8_4 |
| Red Hat rhel tus 8.4 | flatpak-selinux | 0:1.8.5-5.el8_4 |
| Red Hat rhel tus 8.4 | flatpak-session-helper | 0:1.8.5-5.el8_4 |
| Red Hat rhel tus 8.4 | flatpak-session-helper-debuginfo | 0:1.8.5-5.el8_4 |
| Red Hat rhel tus 8.4 | flatpak-tests-debuginfo | 0:1.8.5-5.el8_4 |
| Red Hat rhel tus 8.6 | flatpak | 0:1.8.7-2.el8_6 |
| Red Hat rhel tus 8.6 | flatpak-debuginfo | 0:1.8.7-2.el8_6 |
| Red Hat rhel tus 8.6 | flatpak-debugsource | 0:1.8.7-2.el8_6 |
| Red Hat rhel tus 8.6 | flatpak-libs | 0:1.8.7-2.el8_6 |
| Red Hat rhel tus 8.6 | flatpak-libs-debuginfo | 0:1.8.7-2.el8_6 |
| Red Hat rhel tus 8.6 | flatpak-selinux | 0:1.8.7-2.el8_6 |
| Red Hat rhel tus 8.6 | flatpak-session-helper | 0:1.8.7-2.el8_6 |
| Red Hat rhel tus 8.6 | flatpak-session-helper-debuginfo | 0:1.8.7-2.el8_6 |
| Red Hat rhel tus 8.6 | flatpak-tests-debuginfo | 0:1.8.7-2.el8_6 |
| Rocky Linux 8 | flatpak | 0:1.12.9-1.el8_10 |
| Rocky Linux 9 | flatpak | 0:1.12.9-1.el9_4 |
| SUSE Enterprise Storage 7.1 | flatpak | 1.10.8-150200.4.18.1 |
| SUSE Enterprise Storage 7.1 | xdg-desktop-portal | 1.8.0-150200.5.6.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | flatpak | 1.10.8-150200.4.18.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | xdg-desktop-portal | 1.8.0-150200.5.6.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | flatpak | 1.10.8-150200.4.18.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | xdg-desktop-portal | 1.8.0-150200.5.6.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | flatpak | 1.12.8-150400.3.6.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | xdg-desktop-portal | 1.10.1-150400.3.6.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | flatpak | 1.12.8-150400.3.6.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | xdg-desktop-portal | 1.10.1-150400.3.6.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | bubblewrap | 0.11.0-150500.3.9.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | flatpak | 1.16.0-150500.3.15.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS | wayland-protocols | 1.36-150500.3.3.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | bubblewrap | 0.11.0-150500.3.9.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | flatpak | 1.16.0-150500.3.15.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS | wayland-protocols | 1.36-150500.3.3.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP6 | bubblewrap | 0.11.0-150500.3.9.1 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP5 | flatpak | 1.14.5-150500.3.9.1 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP5 | xdg-desktop-portal | 1.16.0-150500.3.6.1 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP6 | flatpak | 1.16.0-150600.3.6.1 |
| SUSE Linux Enterprise Module for Desktop Applications 15 SP6 | xdg-desktop-portal | 1.18.2-150600.4.3.1 |
| SUSE Linux Enterprise Server 12 SP5 | flatpak | 1.4.2-3.6.1 |
| SUSE Linux Enterprise Server 12 SP5 | xdg-desktop-portal | 1.4.2-3.3.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | flatpak | 1.10.8-150200.4.18.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | xdg-desktop-portal | 1.8.0-150200.5.6.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | flatpak | 1.10.8-150200.4.18.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | xdg-desktop-portal | 1.8.0-150200.5.6.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | flatpak | 1.12.8-150400.3.6.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | xdg-desktop-portal | 1.10.1-150400.3.6.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | bubblewrap | 0.11.0-150500.3.9.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | flatpak | 1.16.0-150500.3.15.1 |
| SUSE Linux Enterprise Server 15 SP5-LTSS | wayland-protocols | 1.36-150500.3.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | flatpak | 1.4.2-3.6.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | xdg-desktop-portal | 1.4.2-3.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | flatpak | 1.10.8-150200.4.18.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | xdg-desktop-portal | 1.8.0-150200.5.6.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | flatpak | 1.10.8-150200.4.18.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | xdg-desktop-portal | 1.8.0-150200.5.6.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | flatpak | 1.12.8-150400.3.6.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | xdg-desktop-portal | 1.10.1-150400.3.6.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | bubblewrap | 0.11.0-150500.3.9.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | flatpak | 1.16.0-150500.3.15.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP5 | wayland-protocols | 1.36-150500.3.3.1 |
| Ubuntu 24.04 LTS | flatpak | 1.14.6-1 |
| Ubuntu Pro 18.04 LTS | flatpak | no fix |
| Ubuntu Pro 20.04 LTS | flatpak | no fix |
| Ubuntu Pro 22.04 LTS | flatpak | no fix |
| openSUSE Leap 15.5 | flatpak | 1.14.5-150500.3.9.1 |
| openSUSE Leap 15.5 | xdg-desktop-portal | 1.16.0-150500.3.6.1 |
| openSUSE Leap 15.6 | bubblewrap | 0.11.0-150500.3.9.1 |
| openSUSE Leap 15.6 | flatpak | 1.16.0-150600.3.6.1 |
| openSUSE Leap 15.6 | xdg-desktop-portal | 1.18.2-150600.4.3.1 |
| openSUSE Tumbleweed | flatpak | 1.15.8-1.1 |